TenantBird Privacy Policy

1. The short version

This Policy is a notice: it describes what we do. It is not itself your consent. We always obtain your express, separate consent before any credit check, income verification, or identity check runs, normally through a dedicated consent screen inside the product, and in every case before the check is ordered (Section 5.1 describes the consent path when a landlord starts screening outside that flow). For the non-sensitive operational data described in Section 4.4 (usage and diagnostic information), the consent we rely on is your informed use of the Services after this notice; Section 10 explains how to limit that collection, including opting out of identified analytics by contacting our Privacy Officer.

2. Who we are and what this Policy covers

Tenant Bird ("TenantBird", "we", "us") operates the TenantBird leasing and tenant-screening platform at tenantbird.com and app.tenantbird.com, including related subdomains and any mobile applications we publish (the "Services").

Your use of the Services is governed by our Terms of Service, which form the contract between you and TenantBird, including its provisions on liability and on where disputes are resolved. This Policy describes our personal-information practices. Nothing in the Terms reduces any right you have under applicable privacy or consumer-reporting law.

Our handling of personal information is governed primarily by the Personal Information Protection and Electronic Documents Act (PIPEDA). If you reside in a province with its own private-sector privacy law (Quebec, British Columbia, or Alberta), you may have additional rights under that law. Section 17 describes province-specific notices.

This Policy covers:

• the TenantBird website and application;
• email, SMS, and in-app messages we send in connection with the Services; and
• the personal information of everyone the Services touch: Applicants and tenants, Operators (landlords, property managers, and agents), named owners of properties, people who send an inquiry about a listing without an account, and people who appear inside applications without holding an account (references, guarantors, and emergency contacts).

When we say "landlord" in this Policy, we mean the Operator handling the listing you applied to, including any property manager or agent acting for them.

It does not cover the independent practices of the landlords you apply to (see Section 7) or of third-party websites we link to.

3. Our Privacy Officer (accountability)

TenantBird has designated a Privacy Officer who is accountable for our compliance with this Policy and with PIPEDA. The Privacy Officer handles access, correction, and deletion requests, consent withdrawals, screening-report disputes, questions, and complaints.

• Email: privacy@tenantbird.com

4. What we collect

4.1 Applicants and tenants

Identity and contact. Your full name, email address, phone number, and profile photo (if you add one); your date of birth; your driver's licence number (if you provide it); your current address; and up to three prior residences with the contact details of the landlords at those residences, if you choose to add rental history.

Social Insurance Number (SIN). Providing your SIN is optional and never required to submit an application. If you provide it, we use it for one purpose only: to improve the accuracy with which the credit bureau matches your credit file, and we send it to our screening partner for that purpose. It is protected with strict access controls and encryption in storage, including application-level encryption, and it is scrubbed when your account is deleted. We do not use your SIN for anything else.

Employment and income. Employer name and address, job title, employment type, self-declared annual income, and supervisor contact details.

References and contacts. Your current landlord's name and contact details, your current rent and reason for leaving; personal references; an emergency contact (name, phone, relationship).

Application answers. Your answers to the application questions about pets, smoking, bankruptcy, and prior eviction; the occupants you list on your application; and your answers to any additional questions the landlord asks on their application form. Your answers are snapshotted onto your application at the moment you submit it, so the landlord sees exactly what you answered, and the standard answers are kept on your profile so your next application can be prefilled.

Documents you upload. Your document vault (private storage, 1 GB per user) can hold: government photo ID, proof of income, pay stubs, employment letters, tax documents (T1 / Notice of Assessment), bank statements, an existing credit report, reference letters, landlord references, rental history, pet records, status documents (work or study permits, PR card), a SIN document, and other documents, plus any custom document a landlord asks for by name on a specific listing.

Screening results we store. When you consent to screening, we store the results delivered back to us:

• the contents of your credit report, obtained from a Canadian consumer reporting agency through our screening partner: credit score, tradelines, collections, bankruptcies, legal items, secured loans, credit inquiries, and the addresses and employers that appear on your credit file;
• your identity-verification result, including the document type and expiry; the document number is stored masked (last four digits only);
• a normalized income-verification summary from our bank-verification provider: institution names, account names, types and masks, account owner names, income sources and amounts, pay frequency, and a confidence indicator, including the individual income-related transactions (date, description, amount) that support each income source. We do not store your other banking transactions, and never your bank credentials (Section 5.2);
• a rental-readiness indicator we compute from the report's own contents (Section 9).

Records we keep about the process. A versioned record of each consent you give, including screening consents and marketing consent (the exact consent text shown to you, identified by a cryptographic hash, with the timestamp and, where available, the IP address and browser details it was given from); signed lease PDFs and e-signature records (signer name and email); an application activity timeline; and a log of report views. We log each time a landlord views your report. Landlords and their agents may also record notes and decision reasons about your application on the platform; these are part of the records we hold and are covered by your access rights in Section 14, subject to legal exemptions (for example, where disclosure would reveal another person's personal information).

4.2 Operators (landlords, property managers, agents)

Name, email, phone, and profile photo; brokerage name, real-estate licence number, and real-estate board (for agents); your properties, units, listings, rents, and photos; and, where you use them, records you enter in optional tools (such as property financial records categorized for tax reporting).

Payment information. Screening is paid for by Operators, by card. Your full card details are entered directly with our payment processor and are never stored on our servers; we keep only a customer reference. You can save a default payment method with the processor so that per-applicant screening charges can be made automatically as each applicant is screened. Applicants are never asked for payment information, and our Terms of Service prohibit Operators from passing screening costs on to applicants or tenants.

Identity verification (KYC). Operators may be required to complete identity verification through a third-party verification provider, which processes your name, date of birth, and identity documents (Section 5.3), before publishing a paid listing or taking leasing actions.

4.3 People without an account

• Named owners of properties: name, email, and phone, provided by the Operator. We reach named owners through secure, expiring links scoped to their property. Links that permit signing are single-use; no account is required for a named owner, though an owner can choose to claim an account through a single-use link.
• People who inquire about a listing. You can ask about a listing without creating an account. The inquiry form collects your name and email (required), your phone number and desired move-in date (optional), your message, and your answers to any optional questions the landlord chose to ask about the listing, which can include household income, income source, occupants, pets, smoking, and a credit-score range. Your answers are shown to that landlord exactly as you gave them; no verdict or score is computed from them, and the landlord may invite you to apply. We retain inquiries so the landlord can follow up; Section 14.4 explains how to have your inquiry corrected or removed, no account needed.
• References, prior landlords, guarantors, and emergency contacts named inside an application: the contact and relationship details the Applicant provides.

If you are one of these people and want to access, correct, or remove your information, Section 14.4 gives you a direct channel. You do not need an account.

4.4 Information collected automatically

IP address, device and browser information, and server logs; product usage events (pages, features used, and interactions such as clicks) collected by our analytics provider and associated with your account (email and name) once you sign in; session replays used for support and product improvement: our analytics provider can record how the signed-in app looked and was used during a session (anything you type is masked), and our error-monitoring provider records a small sample of sessions (about 5%) and sessions where errors occur, with text masked and media blocked; error reports and performance measurements; and any feedback or bug reports you submit in-product. See Section 10 (Cookies).

4.5 Summary table

5. How each check works

5.1 Credit check

Before any credit check runs, you see a dedicated consent screen within the application you are completing for a specific listing; it identifies the screening partner and the credit bureau involved, and the consent authorizes the landlord for that listing and our screening partner to run the checks. If you consent, we send our screening partner your name, email, date of birth, current address (and your residence history within the last 12 months, if provided), the property address, and, only if you chose to provide it, your SIN. The partner obtains your credit report from a Canadian consumer reporting agency and returns it to us for inclusion in your screening report. If a landlord brings an applicant to screening outside this standard flow, our Terms of Service require the landlord to give the applicant written notice and obtain their express consent before ordering the check, and we may require proof of that consent before processing the order.

Tenant-screening credit checks made through TenantBird are intended to be processed as soft inquiries under current bureau policy: a soft inquiry does not affect your credit score and is not visible to lenders, although you will see it when you view your own credit file. (The bureaus, not TenantBird, control inquiry classification.)

If your credit file is frozen. If you have placed a security freeze on your credit file with the bureau our checks use, the bureau may be unable to release your credit information for tenant screening, and you may need to temporarily suspend the freeze (free of charge) before your screening report can be completed. In Ontario, security freezes are a statutory right under the Consumer Reporting Act framework in force since July 1, 2026.

5.2 Bank-based income verification

If you consent to income verification, you connect your bank through our bank-verification provider. Your bank credentials are entered directly with that provider and never touch TenantBird. The provider identifies itself, and links its own privacy policy, in its connection flow. It returns income and account information, from which we store the summary described in Section 4.1, including the income-related transactions that support each income source, but not your other banking transactions, and no credentials. If you withdraw consent during verification, the verification stops; results already delivered to the landlord with your consent are handled as described in Section 14.3.

5.3 Identity verification

Identity verification is performed by third-party verification providers, which identify themselves in the verification flow. The provider processes your government ID document and, where the verification template requires it, a selfie used for biometric matching against the document. We store the outcome (document type, expiry, and a masked document number showing the last four digits only), not the biometric data itself. Our screening partner states in its privacy policy that it retains biometric data for 30 days from collection.

5.4 Documents

Documents you upload are private by default and are never public. Once you have an active application with a landlord, that landlord can access the documents attached to or requested through that application; documents in your vault that are not part of an application with that landlord stay private to you. That access is revoked automatically when you withdraw the application or it expires. Section 7 describes the sharing scope in full, including that an application that has been declined or has led to a lease does not expire automatically.

5.5 Leases and e-signatures

When a lease is prepared and signed through TenantBird, the signer's name and email and the lease contents (party names, property address, rent, and any additional terms or attached addenda) are processed by our e-signature provider. We retain the signed lease and its signing audit trail (signer identity details and timestamps) to document execution.

6. Why we use your information (purposes)

We collect and use personal information only for these purposes:

1. to create and authenticate your account;
2. to assemble a rental application you choose to submit, including the identity, employment, residence, and rental-history information you provide;
3. with your express consent, to obtain a credit report through our screening partner, to verify your income through our bank-verification provider, and to verify your identity;
4. to deliver your completed application and screening report to the landlord you applied to;
5. to deliver a listing inquiry you choose to send to the landlord for that listing;
6. to prepare, sign, and store lease agreements;
7. to process Operator payments for screening;
8. to send the service communications described in Section 11;
9. for safety, security, and fraud prevention, and to meet our legal obligations (including breach reporting and record-keeping under privacy and consumer-reporting law, such as responding to a request to investigate a dispute);
10. to protect TenantBird, our users, and others as described in Section 7.5 (enforcing our Terms, legal claims, professional advice, preventing imminent serious harm); and
11. to understand how the Services are used and improve them, using the usage and diagnostic data described in Section 4.4, not the contents of your screening results or documents.

We will not use your information for a new purpose without first obtaining your consent, except where permitted or required by law.

We do not use screening information to build shared "do not rent" lists, and we do not score, rank, or categorize applicants on grounds protected by human rights law.

7. Who we share your information with

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising. We do not share personal information with affiliated companies.

7.1 The landlords you apply to

Your application materials are private by default and become accessible only to the landlords with whom you have an active application, one you have not withdrawn and that has not expired, the same term our Terms of Service use, and, for properties with named owners, to that owner through a secure, expiring link scoped to the property. Document access is scoped per application: a landlord sees the documents attached to or requested through your application with them, not the rest of your vault. An application expires 30 days after submission (you can extend it); when you withdraw an application or it expires, that landlord's access is revoked automatically. An application that has been declined or has led to a lease does not expire automatically, and that landlord's access continues until you withdraw the application, its contents are destroyed on the Section 12 schedule, or your account is deleted. We log when a landlord views your report.

Landlords must use your screening information only to assess your application, and they are independently responsible under privacy and consumer-reporting law for their own handling of it, including any copies they make outside the platform and any decisions they reach.

7.2 Sharing you choose to start

If you use a feature that shares your information with someone you name (for example, sharing a verification summary by email through a secure link), we share exactly what the feature describes, with the person you chose, and we log views of what you shared. You can stop sharing by revoking the link where the feature offers it or by contacting us.

7.3 Service providers

Service providers run parts of the Services for us: hosting, payments, screening, verification, e-signatures, email and SMS delivery, notifications, AI features, analytics, and diagnostics. Section 8 describes each category and where it processes your information.

7.4 Legal requirements

We may disclose personal information where required or permitted by law. Examples: in response to an order of a court or of the Landlord and Tenant Board in a tenancy proceeding, a subpoena, or another enforceable demand; to a government institution that has identified its lawful authority to obtain it; to investigate fraud or a breach of agreement; or in an emergency that threatens a person's life, health, or security. We will not disclose more than is necessary, and where the law allows, we aim to tell you before or after we disclose.

7.5 Business transfers

If TenantBird is sold, merges, or raises financing, personal information may move with the business. Personal information shared during the transaction is protected by confidentiality agreements and used only to evaluate or complete it. If the transaction is completed, you will be notified within a reasonable time that it has been completed and that your personal information was transferred, and we will make it a condition of the transfer that the recipient use your personal information only consistently with this Policy or notify you before applying a materially different privacy policy to it.

7.6 Protecting TenantBird, our users, and others

We may use and disclose personal information where reasonably necessary to enforce our Terms of Service, to detect, investigate, and prevent fraud or misuse of the Services, to establish, exercise, or defend legal claims, to reduce an imminent risk of serious harm to a person, and to obtain advice from our lawyers, auditors, and insurers under obligations of confidentiality, in each case as permitted by PIPEDA.

8. Service providers and where your information goes

Your application data and documents are stored in our primary database and document storage in Canada (the Canada Central cloud region). Some of our service providers process personal information outside Canada, principally in the United States. Rather than naming each vendor (they change from time to time), this table describes each category of provider; we will identify any specific provider on request to the Privacy Officer, including what it does for us and the countries where it processes personal information. Providers that participate in a check you consent to (the screening partner, credit bureau, and verification providers) also identify themselves directly in the consent and verification flows.

We will keep this table current; see Section 19 for how provider changes are notified.

Cross-border disclosure. While your information is in another country, it is subject to the laws of that country and may be accessible to its courts, law enforcement, and national security authorities. We cannot offer the Services without these providers, so using TenantBird means some of your personal information will be processed outside Canada, principally in the United States, as described above.

Providers that process personal information on our behalf act on our instructions, under contracts requiring a level of protection comparable to this Policy. Some organizations behind this table are not only our processors: the consumer reporting agency that supplies credit information, our screening and bank-verification partners, our payment processor (for its fraud-prevention signals), and our maps provider also process personal information under their own privacy policies as independent organizations, as described in Sections 5 and 10. You can obtain written information about our policies and practices regarding service providers outside Canada, including the providers' identities, the countries where processing occurs, and the purposes each provider is authorized for, by contacting our Privacy Officer.

9. AI features (automated tools and human decisions)

TenantBird uses third-party AI providers, which process data in the United States, in the following specific ways:

• Screening-report summaries. To generate the summary at the top of a screening report, we send an AI provider information from the application and report: the applicant's name, credit score, self-declared annual income, an affordability comparison against the listing's rent, readiness indicators, and application answers (Section 4.1).
• Rental-readiness indicator. Reports with paid screening can include a readiness score that TenantBird computes with deterministic rules (not AI) from the report's own contents: credit health, verified income against the stated rent, rental history, and verification completeness. No score is produced from income alone, the underlying data is always shown beside it, and it is an informational aid, never a decision or a recommendation. Our terms require landlords to treat it as one input among others.
• Operator assistant. A chat assistant for Operators that can look up the Operator's own properties, tenancies, applications, and screening reports (including report contents the Operator already has access to) to answer questions. Conversations are stored briefly (Section 12). The assistant can prepare actions (for example, updating an application's status or importing a listing), but an action runs only after the Operator explicitly approves it, and every approved action is logged.
• Drafting help. Tools that help Operators draft listing descriptions, notes, lease clauses, and screening questions produce suggested text that the Operator reviews and edits before use.
• Search. Search text an Operator types (for example, to find a report or a help article) is processed by an AI provider to find matching results. We do not send the contents of your documents to any AI provider.
• Listing import. When an Operator imports a listing from a URL, our import provider fetches that public page and an AI provider extracts the listing details from it.

Our AI requests are routed through AI infrastructure in the United States, and we monitor AI usage with telemetry that records usage metadata, not conversation content.

Our commitments about these tools:

• AI-generated summaries and assistant responses are labelled as AI-generated where they appear; drafting tools produce suggested text that the Operator reviews and edits before use.
• Summaries are generated only from the information in your application and report. Like any AI output, they can contain errors or omissions: they are informational aids, not a recommendation or a decision, and our terms require landlords to verify them against your actual application materials before relying on them.
• TenantBird makes no decision about your application and renders no automated decision about you: we do not select, recommend, approve, or reject any applicant. The decision is the landlord's, and our terms require landlords to have a human review your application materials before any adverse decision.
• If you believe an AI-generated summary or a readiness indicator about you is inaccurate, contact our Privacy Officer: a human will review it, we will correct the underlying information where warranted, and we will regenerate the output.
• Your screening information is never used for advertising and is never sold to anyone.

10. Cookies and similar technologies

What is actually set when you use TenantBird:

• Strictly necessary: session cookies from our sign-in provider that keep you signed in, and a signed cookie used during staff support access (Section 13). These are required for the Services to work.
• Preferences: first-party cookies that remember interface choices (for example, list or grid views and sidebar state).
• Analytics: our analytics provider records pageviews, feature-usage events, and interactions. Once you sign in, this is identified analytics: events are associated with your account (email and name). Analytics requests are routed through our own domain. In the signed-in app, the same provider can record session replays for product improvement and support; anything you type is masked in these recordings.
• Diagnostics: our error-monitoring provider records errors, performance measurements, and masked session recordings on a small sample of sessions (about 5%, and when errors occur), with text masked and media blocked.
• Payments: our payment processor sets fraud-prevention cookies on payment pages.
• Maps: our maps provider may set cookies on pages that use address autocomplete or maps.

Your control is through your browser settings, which can block or delete cookies; blocking strictly necessary cookies will prevent sign-in. You can also opt out of identified analytics and session replay by contacting our Privacy Officer (Section 3). We do not currently offer an in-product cookie preference centre.

What we do not do: no third-party advertising cookies, no ad networks, no device fingerprinting for advertising or cross-site tracking (our payment processor collects device signals on payment pages solely for fraud prevention, as described above), no tracking of children, and screening data is never used for behavioural advertising.

11. Messages we send you

Service and transactional messages. When you use TenantBird, we send messages necessary to operate the Services (application invitations, application and screening status updates, document requests, lease-signing requests, payment receipts, and security or account notices) by email, SMS, and in-app notification. These are not marketing: we send them because they are part of providing the Services you, or the landlord you applied to, asked for. Some service messages, such as delivering a screening report that was purchased, payment receipts, and factual notices about your account or screening credits, are sent under the transactional exceptions in Canada's Anti-Spam Legislation. They do not require marketing consent, but they still identify the sender. You cannot opt out of messages that are genuinely essential: security notices, legally required notices, and messages needed to complete an application or lease you are participating in (you can close your account or withdraw an application instead).

Invitations sent on a landlord's behalf. If a landlord invites you to apply through TenantBird, the invitation identifies TenantBird and the person it is sent on behalf of. You are never required to act on an invitation (you can simply ignore it), and you can stop further invitation texts at any time by replying STOP, no account needed.

Marketing messages. We ask for your marketing consent with an unchecked box, and we keep a dated record of each consent and withdrawal, including the exact text you saw. We send marketing or promotional messages only in accordance with Canada's Anti-Spam Legislation: where you have given us consent, or where we have implied consent because of an existing business relationship with you (generally within two years of a purchase or six months of an inquiry). Every marketing message identifies TenantBird, includes our contact information, and contains a free, one-step unsubscribe (an unsubscribe link in email; reply STOP to texts). Unsubscribe links remain valid for at least 60 days, and we honour every unsubscribe without delay and in any event within 10 business days. Unsubscribing from marketing does not stop essential service messages.

12. How long we keep your information, and what deletion really does

Account deletion, and what actually happens. When you delete your account, we delete or irreversibly anonymize your personal information: your name, contact details, SIN, date of birth, addresses, employment details, references, and document contents are scrubbed or purged, and your uploaded files are queued for permanent deletion. This is subject to retention the law requires and to one exception: signed agreements, consent records, and signing audit trails are retained in identifiable form (signer name, email, and signing events) for the periods in the table above notwithstanding account deletion, because they document transactions other parties were part of; we do remove the network address and device details from consent records at that point. Other skeleton records, such as the fact that a screening report existed and application audit events, are retained without your personal identifiers. Residual copies may persist in encrypted backups for a limited period until those backups are rotated; backup copies are not used or restored except for disaster recovery and are then overwritten.

What deletion cannot undo. Information already delivered to a landlord with your consent cannot be recalled by deleting your account, although their access through TenantBird ends when your application is withdrawn or expires, or when your account is deleted.

Legal hold. Information that is the subject of an access request, dispute, or complaint is preserved until that process, and any recourse from it, is complete, even if a destruction date in the table above would otherwise pass.

13. How we protect your information

We protect personal information with safeguards appropriate to its sensitivity. Because credit, income, and identity information is highly sensitive, it receives our highest tier of protection. Our safeguards include:

• row-level access controls on user data throughout our database, including document storage, with document access scoped per application;
• encryption in transit (TLS, with HTTP Strict Transport Security) and encryption at rest at the infrastructure level, with application-level encryption for the most sensitive screening fields (such as SIN);
• private document storage with per-user quotas and file-type restrictions;
• signed, expiring links for no-account access; links that permit signing or claiming an account are single-use;
• verification of the authenticity of inbound webhooks from our payment, screening, and e-signature providers;
• phone-number verification and rate limiting on sensitive operations;
• access logging of report views and an append-only audit trail of application events;
• internal security reviews and least-privilege database access controls.

When we dispose of personal information, the disposal is permanent: documents purged after the 30-day Trash window, report contents destroyed on the Section 12 schedule, and files removed on account deletion cannot be restored by us, subject only to the encrypted-backup rotation window described in Section 12.

No system is perfectly secure; we cannot guarantee the security of information transmitted over the Internet. This does not reduce our safeguarding obligations under PIPEDA.

If a breach happens. If the security of your personal information is compromised in a way that creates a real risk of significant harm to you, we will notify you as soon as feasible, directly where feasible or, where direct notification is not possible or could cause further harm, by indirect public notice as the regulations permit, describing what happened, what information was involved, what we have done to reduce the harm, what you can do to protect yourself, and how to reach us. We will also report the breach to the Privacy Commissioner of Canada and to any other privacy regulator we are required to notify under applicable law (for example, Alberta's Information and Privacy Commissioner, or, for incidents presenting a risk of serious injury, Quebec's Commission d'accès à l'information), notify other organizations (such as credit bureaus or financial institutions) where doing so may reduce the harm, and keep a record of every breach of our security safeguards for at least 24 months.

Staff access for support

When you ask us for help, authorized TenantBird staff may access your account to provide the support you requested. This access is read-only, requires a recorded reason and support reference before it starts, is limited to what is needed to resolve your request, and every access is logged for review. Staff cannot use this access for any other purpose.

14. Your rights: access, correction, deletion, withdrawal

14.1 What you can ask for

Subject to applicable law, you may:

• access the personal information we hold about you;
• ask what we hold, how it is used, and to whom it has been disclosed;
• ask us to correct inaccurate or incomplete information;
• withdraw consent (Section 14.3);
• ask us to delete information we no longer need; and
• receive computerized information you provided to us in a structured, commonly used format, where applicable law provides that right.

14.2 How it works

Send requests in writing to the Privacy Officer (Section 3); we will help you prepare your request if you need assistance. We respond within 30 days. In limited cases PIPEDA allows us one extension of up to 30 additional days; if so, we will tell you in writing within the first 30 days, including your right to complain to the Privacy Commissioner of Canada. Access is provided at minimal or no cost; we will tell you of any cost in advance and proceed only if you confirm. If we refuse any part of a request (for example, because the records would reveal another person's personal information that cannot be separated), we will tell you in writing, give reasons, and explain your recourse.

14.3 Withdrawing consent, and what it does and does not undo

You may withdraw your consent at any time by contacting the Privacy Officer or using in-product controls, subject to legal and contractual limits. Withdrawing consent during screening stops the screening, and your application may not be able to proceed without it. Withdrawing an application revokes that landlord's access through TenantBird. What withdrawal does not undo: a report already delivered to a landlord with your consent cannot be recalled by us. Before a withdrawal takes effect through the Privacy Officer, we tell you its consequences; in-product withdrawal controls describe their consequences on the screen where you use them.

14.4 If you don't have an account

If your information is in TenantBird because you sent a listing inquiry, or because someone named you in an application or as a property's owner (a reference, prior landlord, guarantor, emergency contact, or named owner), email privacy@tenantbird.com. After verifying your identity, we will tell you what we hold, correct it, or remove it where the law allows.

15. Your rights over screening reports (consumer reporting)

Credit information in your screening report is obtained from a consumer reporting agency through our screening partner. Both are identified on your consent screen and in your report, and we will identify them, with contact details, at any time on request, free of charge.

If your application is declined. If your application is declined, or accepted only on different terms, wholly or partly because of a screening report or of information about you received from any other third party (for example, a reference), the landlord must tell you so at the time the decision is communicated. You then have 60 days to ask for the name and address of the consumer reporting agency that supplied the report (or the nature and source of any other information used), and you may obtain your file from that agency free of charge and dispute anything inaccurate or incomplete.

Disputing your file. You can obtain everything in your consumer file, free of charge, from the agency that supplied it, dispute inaccurate or incomplete information, add a brief explanatory statement, and have corrections sent to recent recipients of your report. Ontario residents can also obtain free monthly electronic copies of their credit report and score under the Consumer Reporting Act amendments in force since July 1, 2026. To reach the right agency, ask us (privacy@tenantbird.com) and we will tell you which agency supplied information for your report and how to contact it.

Our accuracy commitment. We take reasonable steps to ensure your screening report accurately reflects the results delivered to us by the supplying agency and the information you submitted. If you show us that we displayed or transcribed something incorrectly, we will fix it and refresh the report for any landlord who received it through TenantBird, at no cost to you or to the landlord. If the inaccuracy is in the underlying file, we will direct your dispute to the supplying agency, and when the agency corrects your file we will refresh your report the same way. We will never delay or condition your dispute on notifying anyone else first. Where the agency records your disagreement and includes your statement in the file it supplies to us, it will appear in the refreshed report.

Frozen files. See Section 5.1 for how a credit-file security freeze affects screening.

Nothing in this Policy limits or waives any right you have under the Consumer Reporting Act (Ontario) or the consumer reporting, personal-investigations, or credit-reporting legislation of your province; those laws may give you additional rights, and we will point you to the right agency and regulator for your province on request.

16. Children and minors

The Services are intended for people who are at least 18 years old (or the age of majority where they live), and we do not knowingly create accounts for or collect personal information from children. Information about minors may appear inside an application (for example, in documents an Applicant uploads) and is handled as part of that Applicant's application data. If we learn that a child has created an account, we will delete it.

17. Where we operate and province-specific notices

TenantBird is based in Ontario. Listing, application collection, and tenant screening are available for residential rental properties anywhere in Canada that the Services support; lease generation currently supports Ontario and Alberta. The Services are directed to users in Canada but not in Quebec (see our Terms of Service).

Your privacy rights depend on where you live. All users have the rights described in this Policy; provincial law may add to them:

• Quebec. If Quebec's private-sector privacy law applies to you, you may have additional rights, including portability and de-indexing; contact our Privacy Officer to exercise them. No decision about you is made exclusively by automated processing on our platform (Section 9).
• British Columbia. Where personal information has been used to make a decision that affects you, you can ask us for access to it and for an explanation of how it was used (Sections 12 and 14).
• Alberta. Section 8 contains the notice, and the Privacy Officer contact, required for our use of service providers outside Canada; written information about those providers is available from the Privacy Officer on request.

18. Complaints

You may challenge our compliance with this Policy by contacting our Privacy Officer, who will investigate every complaint and respond. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, Quebec K1A 1H3 · 1-800-282-1376 · priv.gc.ca. Depending on where you live, you may also complain to your provincial privacy regulator (in Quebec, the Commission d'accès à l'information).

19. Changes to this Policy

When we change this Policy, we post the updated version here with a new version number and effective date, and we keep a change log (archived versions available from the Privacy Officer). For material changes (any new purpose, new category of data, or new type of recipient that would use your information for its own purposes) we will notify you by email or in-app notice before the change takes effect, and where the change involves using your information for a new purpose, we will obtain your fresh consent before applying it to you, except where permitted or required by law (Section 6). Replacing a service provider that processes information on our behalf for the same purpose is not a new purpose: we will update the Section 8 categories if they change and, for providers handling screening data, give advance notice. Continued use alone is never how we obtain consent to a material change.

20. Contact us

• Privacy Officer (privacy requests, disputes, complaints): privacy@tenantbird.com
• General support: hello@tenantbird.com

If anything in this Policy is unclear, email us and we will explain it in plain language.

Change log